#ifndef KWDB_SDK_CONFIG_H
#define KWDB_SDK_CONFIG_H

#include <string>

namespace kwdb {

/**
 * @brief Security configuration for KWDB Client
 *
 * Provides unified security settings across C++ and Java SDKs:
 * - TLS/SSL encryption
 * - Bearer Token authentication
 * - Basic authentication (username/password)
 * - GZIP compression (reserved for future HTTP/ILP support)
 */
struct SecurityConfig {
    /// Enable TLS/SSL encryption
    bool tls = false;

    /// Path to CA certificate file (PEM format) for custom TLS verification
    /// If empty and tls=true, uses system default trust store
    std::string ca_cert_path;

    /// Bearer token for Authorization header (takes precedence over Basic auth)
    std::string auth_token;

    /// Username for Basic authentication (used if auth_token is empty)
    std::string username;

    /// Password for Basic authentication (used with username)
    std::string password;

    /// Enable GZIP compression (reserved for future ILP/HTTP client)
    bool gzip = false;

    SecurityConfig() = default;

    /// Check if any authentication is configured
    bool has_auth() const {
        return !auth_token.empty() || (!username.empty() && !password.empty());
    }

    /// Get Authorization header value
    std::string get_auth_header() const;
};

/**
 * @brief Configuration for KWDB Ingest Client
 *
 * Unified configuration structure matching Java SDK's Config class.
 */
struct IngestConfig {
    /// Ingest service endpoint (host:port or "local" for UDS)
    std::string ingest_endpoint;

    /// Request timeout in milliseconds
    int timeout_ms;

    /// Security configuration (TLS, authentication, compression)
    SecurityConfig security;

    IngestConfig()
        : ingest_endpoint("127.0.0.1:9090"),
          timeout_ms(5000) {}

    IngestConfig(const std::string& endpoint, int timeout = 5000)
        : ingest_endpoint(endpoint),
          timeout_ms(timeout) {}
};

} // namespace kwdb

#endif // KWDB_SDK_CONFIG_H